Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Microsoft use onmicrosoft.com and microsoftonline.com?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 11 posts

Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#1

Post by kileywm »

In 2019, it seems a given that a cautious user on the internet should be careful about which domains they connect to. Paying close attention to domains, Microsoft users will quickly see that the company doesn't always use microsoft.com - even for high profile endpoints. For example:

* Office 365 services use this endpoint for user login: https://login.microsoftonline.com

* Email: onmicrosoft.com

Can anyone explain the business, user, and technical implications involved in choosing a new domain (microsoftonline.com) over a subdomain of the business's core domain (online.microsoft.com)?

Re: Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#3

Post by ts4z »

saurik wrote: post #2

(This is in no way a complete of even precise answer, but is maybe still helpful.) One big issue is how cookies can be configured by subdomains to affect other subdomains, causing you to sometimes need full domain names to create security boundaries.

This is exactly right. Different parts of the business have different security scopes, and different domains are the easiest way to keep things separate: make the browser help keep data separate, and not share things across the organization.

This can also reduce cookie size, which adds up.

Re: Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#4

Post by russellbeattie »

In addition to what others said about cookies and security, there's also organizational issues as well. In a giant org like Microsoft, services are launched by different groups at different times, and not always (or better said, rarely) in a coordinated manner.

If I had to guess, the team that made microsoftonline.com probably could have dealt with the group that "owns" microsoft.com and gone through all the security, functionality, routing and systems testing involved to add a new subdomain or root-level path, but it was faster, easier and safer to just use a new domain and not worry about 25 years of domain name baggage. Maybe it was actually a coordinated effort to avoid all that, or simply meet a deadline.

You never know. The longer you work in technology, the more you see systems get larger and larger and have their own rational for things that seem insane to an outsider. Maybe microsoft.com is running on an ancient Windows 2000 server and they've forgotten the admin password. You'd think that could never happen at a company like Microsoft (or maybe you would), but you'd be surprised.

Re: Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#6

Post by mc32 »

ts4z wrote: post #3
saurik wrote: post #2

(This is in no way a complete of even precise answer, but is maybe still helpful.) One big issue is how cookies can be configured by subdomains to affect other subdomains, causing you to sometimes need full domain names to create security boundaries.

This is exactly right. Different parts of the business have different security scopes, and different domains are the easiest way to keep things separate: make the browser help keep data separate, and not share things across the organization. This can also reduce cookie size, which adds up.

This all sounds reasonable but Google doesn’t use this strategy and it looks cleaner for the end user. So why can’t O365 do similar?

Re: Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#7

Post by [deleted] »

mc32 wrote: post #6
ts4z wrote: post #3

Earlier quoted context omitted.

This is exactly right. Different parts of the business have different security scopes, and different domains are the easiest way to keep things separate: make the browser help keep data separate, and not share things across the organization. This can also reduce cookie size, which adds up.

This all sounds reasonable but Google doesn’t use this strategy and it looks cleaner for the end user. So why can’t O365 do similar?

[deleted]

Re: Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#8

Post by kerng »

mc32 wrote: post #6
ts4z wrote: post #3

Earlier quoted context omitted.

This is exactly right. Different parts of the business have different security scopes, and different domains are the easiest way to keep things separate: make the browser help keep data separate, and not share things across the organization. This can also reduce cookie size, which adds up.

This all sounds reasonable but Google doesn’t use this strategy and it looks cleaner for the end user. So why can’t O365 do similar?

Not everyone equally applies security concepts and isolation the same way. Google is probably less concerned around certain web attacks compared to Microsoft. Microsoft isolates their corporation from customer things, which is good I'd say.

Re: Why does Microsoft use onmicrosoft.com and microsoftonline.com?

#10

Post by repolfx »

mc32 wrote: post #6
ts4z wrote: post #3

Earlier quoted context omitted.

This is exactly right. Different parts of the business have different security scopes, and different domains are the easiest way to keep things separate: make the browser help keep data separate, and not share things across the organization. This can also reduce cookie size, which adds up.

This all sounds reasonable but Google doesn’t use this strategy and it looks cleaner for the end user. So why can’t O365 do similar?

Google does use it:

googleusercontent.com

gstatic.com

etc

Post reply on HN